Question 1

What is the default policy enforcement behavior?

AIf any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default deny at egress. f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default deny at ingress.

BIf any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default allow at egress, f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default allow at ingress.

CIf any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default allow at Ingress, f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default allow at egress.

DIf any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes into default deny at ingress. f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default deny at egress.

Answer : D

In Cilium's default policy-enforcement mode, an endpoint initially permits ingress and egress traffic. Enforcement changes independently for each direction when a policy selects that endpoint. If a selecting rule contains an ingress section, the endpoint enters default-deny mode for ingress. If a selecting rule contains an egress section, it enters default-deny mode for egress. Only traffic explicitly permitted by the applicable policy rules remains allowed in the restricted direction.

This per-direction behavior is important. An ingress-only policy does not automatically restrict egress, and an egress-only policy does not automatically restrict ingress. Options A and B reverse the relationship between the rule section and the direction being enforced. Option C incorrectly states that selection places the endpoint into default-allow mode; default allow describes the endpoint's condition before it is selected by an enforcing policy.

Cilium also supports always and never enforcement modes. In always, enforcement applies even to endpoints not selected by policy. In never, policy enforcement is disabled. Policies can additionally use enableDefaultDeny for specialized visibility configurations, but those controls do not change the normal default behavior described in the question.

Official references

Policy Enforcement Modes.

Study Guide topic: Network Policy.

Question 2

Which statement about Cilium's identity-based security model is correct?

AAn endpoint identity Is identified by labels and is tied to a single namespace.

BSecurity is based on the identity of a pod, which is derived through labels.

CBy using an IP-address security model, identities can be shared between pods.

DCilium enforces security based on IP addresses as it provides better scalability and flexibility.

Answer : B

Cilium derives a workload's security identity from its security-relevant labels. Network policies then refer to workload characteristics such as application, role, environment, namespace, or service account rather than depending exclusively on transient pod IP addresses. The identity is associated with traffic in the Cilium datapath and validated when policy is enforced. This makes B the accurate description.

The identity is not limited to a single pod. Endpoints that have the same set of identity-relevant labels can share the same numeric security identity, including endpoints located on different cluster nodes. This reduces policy-map growth and allows policy to scale with logical application groups rather than with the number of pod addresses. Namespace information is normally among the labels used to derive identity, but that does not make an identity inherently ''tied to a single namespace'' as option A states.

Options C and D invert Cilium's design. IP addresses remain necessary for packet delivery, but they are not the primary security identifier for Cilium-managed workloads. Pods can be recreated and assigned new addresses while retaining the same relevant labels and therefore the same security intent. Decoupling identity from addressing is precisely what improves scalability and operational stability.

Official references

Cilium Terminology and Identity; Introduction to Cilium and Hubble.

Study Guide topic: Architecture.

Question 3

You are creating a Cilium network policy for pods with the label app: frontend . The policy should allow all pods with that label to communicate with destinations inside 192.168.e.e/24 and using TCP on port 8888.

For example:

Traffic to 192.168.9.23:8888 should be allowed

Traffic to 192.168.10.5:8888 should be denied.

Traffic to 192.168.9.12:5606 should be denied.

Which of the following policies is correct?

Option A

Option B

Option C

Option D

AOption A

BOption B

COption C

DOption D

Answer : C

Option C has the correct Cilium policy structure. It selects pods labeled app: frontend, creates an egress rule with a valid CIDR entry, and combines that destination constraint with toPorts, port 8888, and protocol TCP. Because the CIDR and port restriction are in the same egress rule, traffic must meet both conditions.

Option A uses an unsupported address-range structure with from and to fields rather than CIDR notation. Option B initially resembles the correct form but contains an additional malformed ports item at the egress-rule level. Option D uses unsupported action: allow and action: deny fields inside toPorts; Cilium allow and deny behavior is expressed through policy sections such as egress and egressDeny, not per-port action properties.

The item is nevertheless defective. The prose and examples indicate 192.168.9.0/24, while all displayed CIDR-based options specify 192.168.0.0/24; the source text itself shows the corrupted 192.168.e.e/24. If 192.168.9.0/24 is authoritative, none of the exhibits permits the stated example. The supplied key B is structurally incorrect under the displayed manifests.

Official references

Cilium Layer 3 and CIDR Policies

Study Guide topic: CIDR selectors, Layer 4 ports, and rule composition.

Question 4

Please review the output of cilium status below and answer the question that follows. Please note, the output has been modified for accessibility purposes.

Question 2 cilium status exhibit

Assume the cluster is healthy. What is correct about the ci 1 ium status command output above?

AThe Kubernetes cluster where Cilium has been deployed should consist of four nodes.

BWhen specific Cilium features require Layer 7 processing, the Cilium agent starts an Envoy proxy as a separate process within the Cilium agent pod.

CThe component that allows you to query multiple Hubble instances simultaneously and aggregate the results is unhealthy.

DCilium has been installed and configured in a multi-cluster deployment model to provide load balancing and service discovery.

Answer : B

The status output shows Envoy DaemonSet: disabled (using embedded mode). In embedded mode, Cilium starts Envoy as a separate process inside the Cilium agent pod when a feature requiring Layer 7 processing---such as an L7 network policy, protocol visibility, Ingress, or Gateway API---is used. This is precisely the behavior described in option B.

The remaining choices contradict the exhibit. The Cilium DaemonSet has a desired count of three, which ordinarily indicates three schedulable nodes running Cilium, not four. Hubble Relay: OK means the aggregation component is healthy. Hubble Relay connects to the Hubble instances associated with Cilium agents and presents a multi-node API to clients such as Hubble CLI and Hubble UI. Finally, ClusterMesh: disabled rules out the claim that the installation is currently configured for Cilium Cluster Mesh service discovery and cross-cluster load balancing.

Cilium can alternatively run Envoy through the independently life-cycled cilium-envoy DaemonSet. That is not the deployment displayed here because the DaemonSet is explicitly disabled and embedded mode is reported.

Official references

Envoy deployment modes; Hubble internals.

Study Guide topic: Architecture.

Question 5

What is NOT a valid description of the sidecar-based model?

Apod start-up time can be significantly slowed by the Injection of sidecars, or worse, It can cause race conditions or other instabilities.

BWith sidecars, the instrumentation container is Injected into each pod. The application pod has to be restarted for the sidecar to be added.

CThe sidecar approach used by service meshes forces the instrumentation into the source code of the application.

DUsing a networking sidecar means that all traffic to and from the application has to travel through the network stack to reach a proxy container

Answer : C

C is not a valid description. A service-mesh sidecar externalizes networking functions into a proxy container running beside the application; it does not force the instrumentation logic into the application's source code. In fact, a core service-mesh objective is to provide connectivity, security, traffic management, and observability transparently without requiring application-code changes.

The operational concerns in the other choices are characteristic of sidecar implementations. A proxy must be injected into each workload pod, increasing container count and potentially affecting pod initialization, resource consumption, ordering, and readiness. Adding a sidecar to an existing pod template normally requires the pods to be recreated because Kubernetes cannot dynamically add a new container to an already-running pod.

Traffic interception also directs application traffic through the sidecar proxy and its network namespace paths, adding network-stack traversal and proxy-processing overhead. Cilium's service-mesh design can instead use node-level Envoy proxies together with eBPF traffic redirection, avoiding one proxy container in every application pod. This preserves transparent application behavior while reducing the per-workload operational burden.

Official references

Cilium Service Mesh, Cilium Ingress and Network Policy Example

Study Guide topic: Sidecar-based and sidecar-free service-mesh architectures.

Free Practice Questions for Linux Foundation Cilium-Associate Exam

Question 1

Question 2

Question 3

Question 4

Question 5